Bain: AI speeds attacks, deepens supply-chain risk
Artificial intelligence is sharply accelerating cyberattacks while increasing supply-chain and third-party risks, according to Bain & Company’s 2026 Global Technology Report.
The Bain & Company report finds that AI has compressed the time required for a typical cyberattack from about four weeks to around 18 hours. At the same time, the growing use of AI agents is creating new risks for organizations already managing complex technology and supplier ecosystems.
AI has reduced the typical cyberattack timeline from around four weeks to about 18 hours.
Supply-chain oversight comes under pressure
Bain’s CISO research identifies supply-chain risk as a growing concern. Companies increasingly need to understand how suppliers deploy AI throughout the lifecycle of a contract, including changes introduced after deployment and exposure created by fourth-party providers.
The pace of change is making traditional oversight harder. Vendors can update models and software daily, while supplier-risk programs often still rely on periodic questionnaires that may not capture new dependencies or vulnerabilities quickly enough.
Connected physical-security systems increasingly depend on software, firmware, cloud services and external providers, expanding supply-chain exposure across video, access control and building systems.
AI increases remediation pressure
Bain says leading organizations are increasing remediation budgets by double-digit percentages. Some are also redirecting as much as 20-25% of cybersecurity personnel from other activities to handle alerts generated by AI-powered scans.
The report highlights legacy platforms, network layers and software-as-a-service providers as areas where AI-related risks can become concentrated and difficult to remediate.
Physical and cyber dependencies converge
As physical security infrastructure becomes more software-driven, cyber risk increasingly extends beyond the primary device manufacturer to underlying software, cloud services and other suppliers. For integrators and operators, vendor assessment therefore needs to include lifecycle support, vulnerability management, software updates and visibility into third- and fourth-party dependencies.
Bain argues that organizations should strengthen remediation models rather than wait for a single technology solution to manage emerging AI risks.
As AI accelerates both attack and defense, organizations have less time to identify weaknesses, understand supplier exposure and respond before those weaknesses are exploited. The answer might not simply be more detection, but faster remediation, continuous visibility into supplier dependencies and security management across the full technology lifecycle.
